To stop anonymous visitors from reading a MediaWiki site, change its LocalSettings.php so the anonymous * group loses the read right while the registered user group keeps it. Disable anonymous account creation at the same time if access must be approved rather than self-service.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This makes MediaWiki pages private at the authorization layer. It is not encryption and does not automatically protect uploaded files, every API response, cached copies or extension-provided endpoints. Those surfaces need their own checks before the wiki contains confidential material.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat “private” means in MediaWiki
MediaWiki assigns every visitor to the * group. A signed-in account is also in the user group, and may belong to additional groups such as a custom approval group or sysop. Rights from all of a user’s groups accumulate. Denying a right to * therefore does not cancel a separate grant made to user or another group.
The core private-wiki pattern is consequently two-part: deny read to *, then explicitly grant read to user. Without the second line, registered readers can be blocked along with everyone else, depending on the rest of the installation’s group configuration.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The read right covers wiki pages, including article and talk pages. It does not, by itself, establish a complete security boundary around the server, media files, web caches, APIs or extensions. Treat the setting as MediaWiki authorization, not as encryption.
Check the installation before changing access
Confirm the security branch
MediaWiki’s current access-prevention guidance warns that older releases were affected by CVE-2025-6590. A private wiki should be upgraded to the applicable security release before private content is added. The documented minimum versions are 1.39.13, 1.43.2 and 1.44.0 or later for the branches named in that guidance. Check the release appropriate to your installed branch; do not assume that reaching one of those numbers is sufficient for every branch or extension.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a staging copy first
Make a backup of the database, uploaded files and LocalSettings.php. Apply the permission change to a staging copy or maintenance window, then test both logged-out and logged-in paths. A syntax error in LocalSettings.php can prevent MediaWiki from loading, while an unexpected group grant can leave pages visible to people who should not have access.
Decide who is allowed to create accounts
If anyone may register, the site is not an approval-only private wiki even though anonymous reading is blocked. Decide which administrators will create accounts, whether an account-confirmation or approval workflow is needed, and how those administrators will retain access if a test account is removed.
Apply the registered-users-only setting
1. Edit LocalSettings.php
Add the following configuration after the normal MediaWiki setup code, keeping it in the file that the running wiki actually loads:
# Block anonymous visitors from reading wiki pages.
$wgGroupPermissions['*']['read'] = false;
# Keep reading enabled for registered accounts.
$wgGroupPermissions['user']['read'] = true;
# Stop anonymous self-registration; approved accounts can be created by administrators.
$wgGroupPermissions['*']['createaccount'] = false;The first assignment removes page-reading permission from every visitor in the anonymous group. The second restores it for accounts in the registered-user group. The third prevents visitors who are not signed in from creating their own accounts.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
2. Save, deploy and watch the first request
Save the file with the same ownership and permissions it had before the edit, deploy it to the active web server, and request a page in a private browser window. If the site reports a PHP or configuration error, restore the previous file from the backup, correct the syntax, and repeat the deployment in staging before trying production again.
3. Test both permission paths
Open an article, a talk page and a page that an ordinary registered reader should be able to see while logged out. Anonymous requests should be refused or redirected to the sign-in experience. Sign in with a test account and request the same pages; the account should be able to read them. Test a second account that has any custom groups, because extra memberships can change the result.
Stop anonymous self-registration and approve readers
$wgGroupPermissions['*']['createaccount'] = false; closes the anonymous self-registration path. It does not delete existing accounts and it does not prevent administrators from creating accounts for approved readers. Establish an administrative process for identity checks, account creation, password delivery and removal when someone no longer needs access.
If the wiki needs a queue rather than manual administrator work, add an account-confirmation workflow that fits the installation. Test that workflow separately: an account may exist but still lack the confirmation state required by the chosen process, and a workflow extension may add its own permissions or pages.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not confuse account creation with page reading. A person can be prohibited from creating an account while still being allowed to read if an administrator creates the account, and a configuration that blocks anonymous reading can still leave a registration page visible unless the surrounding login experience is handled deliberately.
Choose what, if anything, remains public
Use $wgWhitelistRead sparingly
MediaWiki provides $wgWhitelistRead for pages that people without the read right may view. A site might expose a main page or selected help and login pages so visitors understand how to request access. Every page placed on that list is intentionally public; it is not a way to make a page “mostly private.” Review the list whenever a page is renamed or its content changes.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Keep the whitelist as small as the reader journey requires. A main page that contains project names, screenshots or links can disclose more than expected, and a help page can reveal operational details. Test each whitelisted title from a logged-out browser and follow links from it to confirm that private pages still require authentication.
Hide even the login or sidebar
If the requirement is that anonymous visitors should not see the main page, sidebar, login screen or any MediaWiki-generated interface, page-level permissions are not the strongest fit. MediaWiki’s access-prevention guidance recommends higher-level web-server authentication such as .htpasswd or an equivalent mechanism. The web server then challenges the visitor before MediaWiki renders a page.
Server authentication adds another credential layer and its own user lifecycle, but it can cover the entire virtual host rather than selected wiki rights. Decide whether the extra maintenance is worthwhile: it is generally appropriate for a small internal site where every request must be authenticated, while MediaWiki permissions are more flexible when different registered groups need different access.
Protect uploaded files separately
Setting read to false restricts wiki pages such as articles and talk pages. It does not automatically make uploaded images, documents or other media inaccessible. A person who knows a file URL may still reach a web-served file unless the installation uses a separate protection mechanism.
Review MediaWiki image authorization, including img_auth.php, or protect the upload directory at the web-server layer. Test a direct URL to an uploaded file while logged out, then test the same URL as a registered reader. Check thumbnails and original files, because a configuration that protects one representation may leave another exposed.
Also inventory files copied to a content-delivery layer, backup host or static directory. Those copies are outside the decision made by the two read assignments. Remove public caching or configure it to respect authentication before publishing sensitive attachments.
Recommended Free Tools
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Review APIs, extensions and cached responses
Do not assume that a page restriction covers every endpoint. Review the API, feeds, search responses, special pages and any extension that exposes content. Extensions can define their own rights, add a group, or provide a route that does not behave like a normal article request.
Run requests while logged out and while signed in, including API calls used by your applications, bots and mobile clients. Check browser caches, reverse-proxy caches and any pre-rendered export. A stale public response can remain accessible after the permission change if a cache is not purged or correctly varied by authentication.
Document each exception. A private deployment is easier to maintain when the team can identify which page titles are whitelisted, which extensions add permissions, where media is served, and which API clients are expected to authenticate.
Audit cumulative permissions
Permissions are evaluated across every group. A custom group that retains read, a sysop membership, or an extension-defined grant can make a user’s effective rights different from those of an ordinary registered account. The anonymous denial does not override a positive grant elsewhere.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →After editing LocalSettings.php, list the groups and memberships used by the installation. Test at least these identities:
- An anonymous visitor with no session.
- A newly created ordinary
user. - An approved user in each custom group.
- A maintenance administrator or
sysop. - An account whose confirmation or approval state is incomplete.
When access is unexpectedly open, find the group or extension that grants the right rather than adding more denials at random. When access is unexpectedly closed, verify that the registered account really belongs to user, that no extension removes its effective right, and that the test request is reaching the configuration file you edited.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Compare the main implementation choices
| Approach | Anonymous page visibility | Self-registration | Whitelisted pages | Uploaded files | Permission interactions | Maintenance burden |
|---|---|---|---|---|---|---|
LocalSettings.php permission pattern |
Blocked when * loses read |
Blocked when * loses createaccount |
Possible through $wgWhitelistRead |
Requires image authorization or web-server protection | Subject to cumulative groups and extension grants | MediaWiki configuration and ongoing permission audits |
| Permission pattern with a small whitelist | Only listed pages remain public | Still controlled separately by createaccount |
Main page, help or login pages can be exposed deliberately | Still requires separate protection | Whitelist and group rules must both be reviewed | Additional public titles must be maintained |
| Web-server authentication | Requests are challenged before MediaWiki renders pages | Self-registration is irrelevant until the visitor passes server authentication | No MediaWiki page whitelist is needed for the outer gate | Can cover files served by the protected host | Operates outside MediaWiki’s group permissions | Requires a separate credential and server-authentication lifecycle |
Use a deliberate verification checklist
- Anonymous article request: open a known article in a fresh private window. Confirm that its content is not displayed.
- Anonymous talk-page request: request the matching talk page directly. Confirm that page-level denial applies there too.
- Login and access instructions: verify that the sign-in or request-access path behaves as intended, especially if it is whitelisted.
- Registered-reader request: sign in with an ordinary approved account and open the same article and talk page.
- Registration attempt: while logged out, try the account-creation path. It should not allow anonymous self-registration after the
createaccountchange. - Custom-group test: repeat the article request for every group that exists on the wiki and record any intentional exceptions.
- Direct media request: copy an original-file URL and a thumbnail URL, then test both logged out and logged in.
- API and extension test: exercise the API calls, feeds, special pages and extension routes used by the site.
- Cache test: repeat requests through the production proxy or CDN after purging old responses, checking that an anonymous client cannot reuse a previously public response.
- Recovery test: confirm that an administrator can still sign in and create an approved account if the registration restriction is active.
Troubleshoot common outcomes
Anonymous users can still read an article
Check that the assignments are in the active LocalSettings.php, not a template or unused copy, and that the web process has loaded the changed file. Then inspect $wgWhitelistRead, custom groups and extension-defined permissions. Finally, purge or bypass caches and test the origin directly.
Registered users are denied as well
Verify the explicit $wgGroupPermissions['user']['read'] = true; assignment and confirm that the account is signed in and belongs to user. A custom permission scheme or extension may have changed the effective rights, so compare the failing account with a newly created ordinary account.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallVisitors can still create accounts
Confirm that the anonymous group has createaccount set to false in the loaded configuration. Check for another assignment later in the file or in an included configuration that re-enables it. Existing accounts remain; this setting controls anonymous self-registration.
Files are visible while pages are private
That result is expected when only the read right was changed. Configure image authorization such as img_auth.php or protect the file path at the web server, then test originals, thumbnails and alternate static locations.
The login or main page is hidden
Decide whether that is acceptable. If visitors need instructions, whitelist only the required titles. If even the login interface must be unavailable to anonymous requests, put authentication at the web-server level and provide an approved route for authorized users.
Maintain the private boundary after launch
Keep a written inventory of groups, administrators, whitelist titles, extensions, media paths, API clients and caching layers. Re-test it after MediaWiki upgrades, extension changes, web-server changes and CDN changes. Permission behavior can change when a new group or extension is introduced even if the three original assignments remain untouched.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Review the applicable MediaWiki security advisories before each upgrade and apply the branch-specific release that addresses known vulnerabilities. A private authorization setting cannot compensate for an unpatched installation. When a user leaves the project, remove the account or its group memberships and invalidate any separate web-server credentials or cached links associated with that person.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
